1. Scope and Application

This combined Privacy Policy and HIPAA Notice of Privacy Practices (this "Notice") describes how SkinnyVIP ("SkinnyVIP," "the Practice," "we," "us," or "our") collects, uses, discloses, and protects your personal information and Protected Health Information ("PHI"). It applies to:

• Visitors to skinnyvip.com and any subdomain we operate;
• Individuals who submit an intake form, book a consultation, or become a patient of the Practice;
• Individuals who contact us via email, phone, or our patient portal (PracticeBetter).

SkinnyVIP is a "covered entity" under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, "HIPAA"). This Notice satisfies our obligation under HIPAA to provide you with a Notice of Privacy Practices ("NPP") and is incorporated by reference into the informed consent you sign at intake.

2. Information We Collect

2.1 Information you provide directly

• Identity and contact: full legal name, date of birth, email address, mobile phone number, shipping address, billing address, state of residence at time of consent, and (when required for prescribing) government-issued identification.
• Health information: medical history; current and past medications, supplements, and vitamins; allergies and adverse reactions; height, weight, and body measurements; prior treatment history and clinician notes; laboratory results you upload or authorize us to receive; pregnancy status and reproductive health information when clinically relevant; family history when clinically relevant; and any other clinical intake responses you submit through PracticeBetter.
• Communications: messages you send to our physicians, staff, or support channels through the patient portal, email, or phone.
• Payment information: billing details submitted at checkout. Payment card data is tokenized by our third-party payment processor; SkinnyVIP does not store full payment card numbers.
• Marketing preferences: your opt-in status for educational newsletters, product updates, and promotional communications.

2.2 Information collected automatically

• Device and usage data: IP address, browser type and version, operating system, referring URL, pages viewed, session duration, and interactions with page elements (via Google Analytics and Meta Pixel).
• Cookies and similar technologies: first-party session cookies for site functionality; third-party cookies for analytics and advertising measurement (see Section 13).

2.3 Information from third parties

• Pharmacy partners: dispensing records, refill status, and tracking information from the licensed compounding pharmacy that fills your prescription.
• Referring clinicians: records shared with your written authorization.

3. HIPAA Notice of Privacy Practices

THIS SECTION SATISFIES OUR OBLIGATION UNDER 45 C.F.R. § 164.520 TO PROVIDE YOU WITH A NOTICE OF PRIVACY PRACTICES. IT DESCRIBES HOW PROTECTED HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

3.1 Our commitment

SkinnyVIP is required by law to (i) maintain the privacy of your PHI, (ii) provide you this Notice of our legal duties and privacy practices with respect to your PHI, (iii) notify you following a breach of your unsecured PHI, and (iv) abide by the terms of the Notice currently in effect.

3.2 Categories of use and disclosure without your authorization

HIPAA permits us to use and disclose your PHI without your written authorization for the following purposes:

• Treatment: to provide, coordinate, or manage your care and any related services, including consultations with our physicians, communications with the compounding pharmacy that fills your prescription, and referrals to other healthcare providers.
• Payment: to obtain reimbursement for services rendered, process payment, and issue refunds.
• Health care operations: for quality assessment and improvement, provider credentialing, business planning, compliance activities, training, and general administrative functions.
• Required by law: when required by federal, state, or local law, including reporting of certain communicable diseases, adverse events (to the FDA MedWatch program), suspected abuse or neglect, and responses to subpoenas or court orders.
• Public health activities: to authorized public health authorities for disease surveillance, product recalls, and similar activities.
• Health oversight: to state medical boards and other health oversight agencies for audits, investigations, and licensure actions.
• Law enforcement: in limited circumstances specifically authorized by HIPAA.
• Serious threats: to prevent or lessen a serious and imminent threat to health or safety.

3.3 Uses and disclosures requiring your written authorization

The following uses and disclosures will be made only with your written authorization, which you may revoke at any time:

• Uses and disclosures of PHI for marketing purposes beyond what HIPAA permits without authorization;
• Sale of PHI (which we do not engage in);
• Uses and disclosures of psychotherapy notes (which we do not maintain in this practice);
• Other uses and disclosures not described in this Notice.

4. How We Use Your Information

We use the information described in Section 2 for the following purposes:

• To evaluate whether treatment is clinically appropriate for you and to prescribe medication when indicated;
• To transmit prescriptions to a licensed compounding pharmacy for filling and shipping;
• To communicate with you about your treatment, refills, dose adjustments, side effects, and follow-up care through the patient portal, email, or phone;
• To process payments, issue refunds, and manage billing disputes;
• To operate, maintain, secure, and improve our website, patient portal, and clinical processes;
• To conduct quality assurance, credentialing, compliance monitoring, and legal defense;
• To comply with legal obligations, respond to lawful requests from government authorities, and enforce our Terms of Service;
• To send educational or promotional communications, only when you have opted in;
• To measure the reach and effectiveness of our educational content and paid marketing (de-identified where feasible).

5. Disclosures to Third Parties

We share information only as needed to provide services, comply with law, or as authorized by you. Categories of recipients include:

• Licensed compounding pharmacies that fill and ship your prescriptions. Each pharmacy is a HIPAA-covered entity or business associate in its own right.
• PracticeBetter, our HIPAA-compliant patient portal and intake platform (business associate).
• Payment processors for billing, refunds, and fraud prevention.
• Shipping carriers (name and address only) for medication delivery.
• Analytics and advertising providers (Google Analytics, Meta Pixel, and similar) for website usage measurement. These providers may receive your IP address and de-identified usage data but are not authorized to receive PHI.
• Professional advisors (attorneys, accountants, auditors) subject to confidentiality obligations, when reasonably necessary.
• Regulators, courts, and law enforcement when required by subpoena, court order, statute, or regulation.
• Successor entities in the event of a merger, acquisition, financing, or sale of all or a portion of our business, subject to the acquiring party’s agreement to honor the terms of this Notice.

We enter into written Business Associate Agreements ("BAAs") with all third parties that handle your PHI on our behalf, as required by HIPAA.

6. Marketing and Sale of PHI

6.1 Marketing communications

We may send you educational and promotional communications only if you have opted in during intake or through a subsequent subscription. You may opt out of marketing communications at any time by using the unsubscribe link in any marketing email or by emailing hello@skinnyVIP.com. Opting out of marketing does not affect operational communications about your treatment.

6.2 We do not sell your PHI

SkinnyVIP does not sell your Protected Health Information under any circumstances and does not receive direct or indirect remuneration in exchange for your PHI. To the extent HIPAA or state law defines certain data-sharing arrangements as a "sale," we do not engage in those arrangements.

7. Your Privacy Rights

You have the following rights with respect to your information. To exercise any of these rights, email hello@skinnyVIP.com and reference this section. We will respond within the timeframe required by applicable law (typically 30 days under HIPAA).

• Right of access: obtain a copy of your PHI and other personal information we hold about you, in the format you reasonably request (paper, electronic, or a portable machine-readable format), subject to the fees permitted by HIPAA.
• Right to amend: request that we correct PHI you believe is inaccurate or incomplete. We may deny the request in limited circumstances specified by HIPAA, in which case we will provide written explanation and permit you to file a statement of disagreement.
• Right to accounting of disclosures: receive a list of certain disclosures of your PHI made by SkinnyVIP within the six years preceding your request. HIPAA excludes certain disclosures (e.g., for treatment, payment, or health care operations) from this right.
• Right to request restrictions: request that we restrict certain uses or disclosures of your PHI. We are not required to agree to every restriction, but we will agree to a restriction on disclosure to a health plan for a service you paid for in full out of pocket.
• Right to confidential communications: request that we communicate with you by a particular means (e.g., a specific phone number, or by email only) or at a particular location.
• Right to a paper copy of this Notice: obtain a paper copy on request, even if you have received it electronically.
• Right to receive breach notification: be notified in the event of a breach of your unsecured PHI, as required by HIPAA.
• Right to revoke authorization: revoke any authorization you have signed for a specific use or disclosure, at any time, in writing (though the revocation does not apply to actions we have already taken in reliance on the authorization).

8. State-Specific Rights

Depending on your state of residence, you may have additional rights under state law. The following is a non-exhaustive summary. If you reside in a state not listed and believe you have rights under that state’s privacy law, contact us and we will respond.

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know the categories of personal information we have collected about you, the categories of sources, the categories of third parties with whom we share it, and the purposes for which we use it (all described in this Notice). You have the right to request deletion, subject to exceptions including medical record retention laws. You have the right to correct inaccurate information. You have the right to opt out of "sharing" of personal information for cross-context behavioral advertising (which we honor via Global Privacy Control browser signals). You have the right to non-discrimination for exercising these rights. To exercise these rights, email us and reference "California privacy rights."

Colorado, Connecticut, Virginia, Utah, and Texas residents

Residents of these states have rights to access, correct, delete, and (in some cases) obtain a portable copy of their personal information; opt out of targeted advertising, sale of personal data (which we do not conduct), and profiling that produces legal or similarly significant effects; and appeal our denial of any such request. To exercise these rights, email us and reference your state name and the right you wish to exercise. We respond within 45 days.

Washington My Health My Data Act

If you are a Washington resident, you have specific rights regarding consumer health data, including the right to withdraw consent, the right to deletion, the right to confirmation of collection, and the right to appeal. Contact us to exercise these rights.

9. Data Security

We implement administrative, physical, and technical safeguards designed to protect your personal information and PHI, including:

• Encryption of data in transit (TLS 1.2 or higher) and at rest for PHI stored in the patient portal;
• Role-based access controls; only workforce members with a treatment, payment, or health care operations need have access to your PHI;
• Audit logging of PHI access;
• Multi-factor authentication for administrative accounts;
• Regular security reviews of our systems and business associates;
• A designated Privacy Officer and Security Officer;
• Written workforce training on HIPAA privacy and security requirements.

Despite these safeguards, no method of electronic transmission or storage is 100% secure. If you believe your account or PHI has been compromised, contact us immediately.

10. Data Retention

We retain your medical record for the minimum period required by the medical record retention law of the state in which you received treatment. Retention periods vary by state and range from approximately six (6) to ten (10) years after the date of last treatment for adult patients, with longer periods for records related to minors (typically until the patient reaches the age of majority plus a state-specified additional period). Non-medical account information (marketing preferences, non-clinical communications) is retained for as long as your account is active plus a reasonable period thereafter, and then deleted or de-identified.

11. Breach Notification

In the event of a breach of your unsecured PHI, we will provide notification as required by 45 C.F.R. Part 164, Subpart D, and applicable state breach notification laws, including notice to you, the U.S. Department of Health and Human Services, and (where applicable) the media. Notice will be provided without unreasonable delay and in no case later than 60 days after discovery of the breach.

12. Children Under 18

SkinnyVIP’s services are intended for adults 18 years of age or older. We do not knowingly collect personal information or PHI from any individual under 18. If you believe a minor has provided information to us, contact us and we will delete the information promptly.

13. Cookies, Analytics, and Tracking

13.1 First-party cookies

We use first-party cookies for essential site functionality (e.g., remembering that you have viewed a modal, maintaining a session, saving form progress).

13.2 Analytics

We use Google Analytics 4 to measure website traffic and content engagement. Google Analytics may collect your IP address and de-identified interaction data. It is not authorized to receive PHI. You can opt out via the Google Analytics Opt-out Browser Add-on.

13.3 Advertising pixels

We use the Meta Pixel to measure the effectiveness of our marketing on Facebook and Instagram. The pixel may collect page views and event actions and is not authorized to receive PHI. You can control the use of your data for advertising in your Meta account settings.

13.4 Do Not Track and Global Privacy Control

Our website honors Global Privacy Control ("GPC") signals as a valid opt-out of "sale" or "sharing" of personal information under CCPA/CPRA and analogous state laws. We do not currently respond to browser "Do Not Track" signals due to the absence of a common industry standard.

14. International Users

SkinnyVIP’s services are provided only to residents of the United States. We do not knowingly collect information from individuals located outside the United States. If you are accessing our website from outside the United States, please be aware that information collected will be transferred to and processed in the United States, which may have data protection laws different from those in your country.

15. Changes to This Policy

We may update this Notice from time to time. Material changes will be posted here with an updated "Effective date" at the top. For patients, we will provide notice of material changes through the patient portal or email. Continued use of our services after the effective date of an updated Notice constitutes acceptance of the changes.

16. Contact and Complaints

You may also file a complaint directly with the U.S. Department of Health and Human Services, Office for Civil Rights, if you believe your HIPAA privacy rights have been violated. You will not be retaliated against for filing a complaint. Contact information: